fix(ocr): round-2 review — lazy store lock, mode enum normalization, type hints

Round 2 review (PR #910):
- BLOCKING: BatchOcrJobStore._shared_lock is now lazy-init (anyio.Lock | None,
  created on first shared() call) instead of at class-definition time — matches
  the CLAUDE.md "no anyio primitives at import time" rule and OcrProcessor's
  pattern. The None-check->assign has no await between, so it's race-free.
- document_ocr_mode now normalizes via _enum_fields (case-insensitive, like
  document_ocr_provider) instead of a strict dynaconf is_in Validator, so
  DOCUMENT_OCR_MODE=Batch normalizes to "batch" rather than erroring. Tests for
  case-normalization + invalid-value rejection.
- TYPE_CHECKING-gated GatewayBatchOcrClient import so build_gateway_batch_client
  / _get_batch_client are typed `GatewayBatchOcrClient | None` instead of Any
  (runtime import stays lazy to avoid the import cycle).
- Rename ocr_options -> doc_identity_options (it's threaded to all tiers; only
  OCR reads it) + clarify the comment.
- Drop the redundant forward-ref quotes on _shared_instance.
- Add direct _batch_identity unit tests (partial/empty options branches).

Left as follow-up: reusing one httpx.AsyncClient across submit/poll (same
per-call pattern as the existing sync _GatewayOcrBackend; no clean aclose hook
on the cached client today).

1653 unit tests pass; ruff + ty green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/vector/processor.py

@@ -984,10 +984,11 @@ async def _index_document(
                 # and the in-process/memory pool (tier is None) -- runs the inline
                 # tiered pipeline (fast -> OCR escalation in one call).
                 if tier is not None and _is_pdf(content_type):
-                    # Thread per-document identity to the OCR tier so batch mode
-                    # (Deck #332) can key its job-tracking table; other tiers
-                    # ignore it.
-                    ocr_options = {
+                    # Per-document identity, forwarded to every tier's processor.
+                    # Only the OCR tier reads it (batch mode keys its job-tracking
+                    # table on it, Deck #332); fast/structured ignore it, so it's
+                    # safe to pass on all tiers.
+                    doc_identity_options = {
                         "user_id": doc_task.user_id,
                         "doc_id": doc_task.doc_id,
                         "doc_type": doc_task.doc_type,
@@ -1000,7 +1001,7 @@ async def _index_document(
                         file_path,
                         tier,
                         settings,
-                        options=ocr_options,
+                        options=doc_identity_options,
                     )
                 else:
                     result = await registry.process(